Information
This policy prevents the user from showing account details (email address or user name) on the sign-in screen.
The recommended state for this setting is: Enabled
An attacker with access to the console (for example, someone with physical access or someone who is able to connect to the workstation through Remote Desktop Services) could view the name of the last user who logged on to the server. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try and log on.
Solution
To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled
Administrative Templates\System\Logon\Block user from showing account details on sign-in
Impact:
Users cannot choose to show account details on the sign-in screen.
Item Details
Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION
References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1
Control ID: 93830394dd890e7f68c30794499ab2d7113f706aa91b649bcc2adacd517b86c4